@tinycloud/sdk-core 3.0.0-beta.0 → 3.0.0-beta.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{credential-admission-C_cO1QqB.d.cts → credential-admission-BVUC6kdw.d.cts} +67 -2
- package/dist/{credential-admission-cvHe-HUC.d.ts → credential-admission-BgvwOTIV.d.ts} +67 -2
- package/dist/delegations/index.cjs +11 -2
- package/dist/delegations/index.cjs.map +1 -1
- package/dist/delegations/index.js +11 -2
- package/dist/delegations/index.js.map +1 -1
- package/dist/index.cjs +416 -3
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +92 -3
- package/dist/index.d.ts +92 -3
- package/dist/index.js +416 -3
- package/dist/index.js.map +1 -1
- package/dist/policy/index.cjs +166 -3
- package/dist/policy/index.cjs.map +1 -1
- package/dist/policy/index.d.cts +2 -2
- package/dist/policy/index.d.ts +2 -2
- package/dist/policy/index.js +166 -3
- package/dist/policy/index.js.map +1 -1
- package/package.json +3 -3
|
@@ -3896,6 +3896,11 @@ var POLICY_SESSION_FACT_KEYS = [
|
|
|
3896
3896
|
"issuanceAuditDigestHex",
|
|
3897
3897
|
"remainingRedelegationDepth"
|
|
3898
3898
|
];
|
|
3899
|
+
var POLICY_SESSION_V4_AUDIT_FACT_KEYS = [
|
|
3900
|
+
"credentialIdAuditDigestHex",
|
|
3901
|
+
"presentationJtiAuditDigestHex"
|
|
3902
|
+
];
|
|
3903
|
+
var LOWER_SHA256_HEX = /^[0-9a-f]{64}$/;
|
|
3899
3904
|
var CompactHeaderSchema = z4.object({
|
|
3900
3905
|
alg: z4.literal("EdDSA"),
|
|
3901
3906
|
jwk: z4.object({ alg: z4.literal("EdDSA"), crv: z4.literal("Ed25519"), kty: z4.literal("OKP"), x: z4.string().min(1) }).strict(),
|
|
@@ -4037,9 +4042,13 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
|
|
|
4037
4042
|
if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
|
|
4038
4043
|
throw new Error("policy session UCAN ordered proofs do not match");
|
|
4039
4044
|
const factKeys = Object.keys(fact);
|
|
4040
|
-
|
|
4045
|
+
const hasLegacyFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact);
|
|
4046
|
+
const hasV4AuditFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length + POLICY_SESSION_V4_AUDIT_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key) || POLICY_SESSION_V4_AUDIT_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact) && POLICY_SESSION_V4_AUDIT_FACT_KEYS.every((key) => key in fact);
|
|
4047
|
+
if (!hasLegacyFactShape && !hasV4AuditFactShape)
|
|
4041
4048
|
throw new Error("policy session UCAN fact is incomplete");
|
|
4042
|
-
if (
|
|
4049
|
+
if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
|
|
4050
|
+
throw new Error("policy session UCAN v4 audit facts are invalid");
|
|
4051
|
+
if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
|
|
4043
4052
|
throw new Error("policy session UCAN fact is invalid");
|
|
4044
4053
|
return {
|
|
4045
4054
|
authorization,
|